This question already has an answer here:
I am building the API for a SPA and Chrome plugin using Rails, and I am inclined to go use Secure HTTPOnly cookies for authentication because:
- This is the default solution for standard Rails auth libraries like Devise and Sorcery.
- Rails has encrypted client-side sessions, which means no server-side storage requirement or DB lookup (yes I know I will still need some kind of server-side tracking and lookup if I want to implement proper session invalidation).
- It's transparent to web-based client libraries.
- Cookies are somewhat hardened compared to local storage, and the problem space is well-trodden and understood.
When you enable Rails API mode it disables both cookies and CSRF protection, so I've re-enabled cookies, but CSRF protection is not as easy to re-enable because it assumes a form will be rendered first (ie. not a POST request coming in cold) and will probably require some fiddling to set up.
If cookies are disabled then I understand CSRF is a non-issue, however as far as I can tell, there is no way for a malicious site to forge a request for type
application/json without using XHR, which would not be allowed without explicit CORS authorization.
Is it a sound security model to authenticate a JSON API with cookies but no CSRF token assuming proper content type validation?